{"id":"CVE-2026-35536","aliases":["ALSA-2026:13641","ALSA-2026:13670","ALSA-2026:19034","ALSA-2026:19189","BELL-CVE-2026-35536","CLSA-2026-1776386115","CLSA-2026-1790675116","DEBIAN-CVE-2026-35536","EUVD-2026-18574","GHSA-753j-mpmx-qq6g","GHSA-78cv-mqj4-43f7","GHSA-8423-8fgw-73vq","GHSA-fqwm-6jpj-5wxc","GHSA-pw6j-qg29-8w7f","GHSA-qppv-j76h-2rpx","GHSA-w235-7p84-xx57","MGASA-2026-0216","OESA-2026-1903","PYSEC-2026-2287","RHSA-2026:13641","RHSA-2026:13670","RHSA-2026:19034","RHSA-2026:19189","RHSA-2026:20572","RHSA-2026:20573","RHSA-2026:20577","RHSA-2026:20810","RHSA-2026:24342","RLSA-2026:13641","RLSA-2026:13670","RLSA-2026:19034","RLSA-2026:19189","ROOT-APP-PYPI-GHSA-78cv-mqj4-43f7","UBUNTU-CVE-2026-35536"],"status":"published","title":"Tornado has incomplete validation of cookie attributes","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00246,"percentile":0.15949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-159","CWE-74"],"published":"2026-03-11T22:17:00Z","modified":"2026-10-29T11:58:14Z","fixes":[{"ecosystem":"PyPI","package":"tornado","fixed_in":["6.5.5"],"sources":["ghsa","osv"]},{"ecosystem":"Alpaquita:25","package":"py3-tornado","fixed_in":["6.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-tornado","fixed_in":["6.5.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-tornado","fixed_in":["6.5.5-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"tornado","fixed_in":["6.2+aikido.10","6.2+aikido.5","6.2+aikido.6","6.2+aikido.7","6.2+aikido.8","6.2+aikido.9","6.2+aikido.11","6.2+aikido.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","fixed_in":["4.2.1-1ubuntu3.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","fixed_in":["4.5.3-1ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","fixed_in":["6.1.0-3ubuntu0.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","fixed_in":["6.4.0-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-tornado","fixed_in":["6.4.2-3ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","fixed_in":["6.5.4-0.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.5.4"},{"fixed":"6.5.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.1-r0"},{"fixed":"6.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.3-r0"},{"fixed":"6.5.5-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1"},{"fixed":"6.1.0.post2+tuxcare"}]}],"versions":["6.1","6.1.0.post1+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.1"},{"fixed":"5.1.1.post4+tuxcare"}]}],"versions":["5.1.1","5.1.1.post1+tuxcare","5.1.1.post2+tuxcare","5.1.1.post3+tuxcare"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-3","6.2.0-3+deb12u1","6.2.0-3+deb12u2","6.2.0-3+deb12u3","6.2.0-3+deb12u4","6.3.2-1","6.4.0-1","6.4.0-2","6.4.1-1","6.4.1-2","6.4.1-3","6.4.2-1","6.4.2-2","6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:13","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.4.2-3+deb13u1","6.4.2-3+deb13u2","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:14","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1"}]}],"versions":["6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1"]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5b1"]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5b1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-1.4.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-4.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-12.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-7.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5b1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2+aikido.10"},{"fixed":"6.2+aikido.5"},{"fixed":"6.2+aikido.6"},{"fixed":"6.2+aikido.7"},{"fixed":"6.2+aikido.8"},{"fixed":"6.2+aikido.9"},{"fixed":"6.2+aikido.11"},{"fixed":"6.2+aikido.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu3.1+esm3"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.2+esm3"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm5"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1","6.1.0-3ubuntu0.1~esm2","6.1.0-3ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.5"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1","6.4.0-1ubuntu0.2","6.4.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-3ubuntu0.3"}]}],"versions":["6.4.2-1","6.4.2-2","6.4.2-2ubuntu1","6.4.2-3","6.4.2-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.4-0.1ubuntu0.1"}]}],"versions":["6.4.2-3","6.5.2-3","6.5.4-0.1"]}],"products":[{"vendor":"tornadoweb","product":"tornado"}],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5","tags":["Product","web","article","report"]},{"url":"https://github.com/tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104","tags":["web"]},{"url":"https://github.com/advisories/GHSA-78cv-mqj4-43f7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35536","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fqwm-6jpj-5wxc","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13641","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31958","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35536","tags":["report"]},{"url":"https://bugzilla.redhat.com/2446765","tags":["report"]},{"url":"https://bugzilla.redhat.com/2454716","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-13641.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13670","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-13670.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19034","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-19034.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19189","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-19189.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-35536","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35536.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-35536","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0216.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35420","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8198-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67724","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454716","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13641.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31958","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31958","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35536","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13670.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19034.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19189.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20572","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20572.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20573","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20573.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20577","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20577.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20810","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20810.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24342","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24342.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:13641","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:13670","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19034","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19189","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-35536","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8198-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-35536","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","status":"published","published":"2026-04-03T02:25:57.427Z","modified":"2026-04-03T13:12:16.105Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-159"],"updated_at":"2026-11-02T14:20:05.15083Z"}],"euvd":[{"id":"EUVD-2026-18574","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","status":"published","published":"2026-04-03T02:25:57Z","modified":"2026-04-03T13:12:16Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:16.92155Z"}],"ghsa":[{"id":"GHSA-78cv-mqj4-43f7","title":"Tornado has incomplete validation of cookie attributes","description":"Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.","status":"published","published":"2026-03-11T22:17:00Z","modified":"2026-03-11T22:17:04Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:39:34.616253Z"},{"id":"GHSA-fqwm-6jpj-5wxc","title":"Tornado has cookie attribute injection via .RequestHandler.set_cookie","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to `.RequestHandler.set_cookie` were not checked for crafted characters.","status":"published","published":"2026-04-03T06:31:31Z","modified":"2026-04-04T06:45:03Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-159"],"updated_at":"2026-11-02T14:39:47.945242Z"}],"nvd":[{"id":"CVE-2026-35536","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","status":"published","published":"2026-04-03T04:16:53.55Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-159"],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"BELL-CVE-2026-35536","status":"published","published":"2026-04-04T06:09:33.114837Z","modified":"2026-04-12T07:15:07.100297Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-35536","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","status":"published","published":"2026-04-03T02:25:57.427Z","modified":"2026-10-28T02:31:08.23173392Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-159"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"DEBIAN-CVE-2026-35536","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","status":"published","published":"2026-04-03T04:16:53.55Z","modified":"2026-10-01T03:03:22.351874051Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-78cv-mqj4-43f7","title":"Tornado has incomplete validation of cookie attributes","description":"Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.","status":"published","published":"2026-03-11T22:17:00Z","modified":"2026-09-10T03:50:37.898992264Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"GHSA-fqwm-6jpj-5wxc","title":"Tornado has cookie attribute injection via .RequestHandler.set_cookie","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to `.RequestHandler.set_cookie` were not checked for crafted characters.","status":"published","published":"2026-04-03T06:31:31Z","modified":"2026-09-10T03:50:44.255695398Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-159"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"OESA-2026-1903","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom \u0026quot;reason\u0026quot; phrases (the \u0026quot;Not Found\u0026quot; in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.(CVE-2025-67724)\n\nIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.(CVE-2026-35536)","status":"published","published":"2026-04-11T11:10:55Z","modified":"2026-08-18T01:19:55.316823729Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2026-2287","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","status":"published","published":"2026-04-03T04:16:53.55Z","modified":"2026-07-13T16:45:06.531920939Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2026:13641","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-05T10:11:57Z","modified":"2026-10-17T10:09:17Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:13670","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-06T10:05:28Z","modified":"2026-10-17T10:09:18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:19034","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-20T10:09:41Z","modified":"2026-10-17T10:10:11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:19189","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-20T10:10:16Z","modified":"2026-10-17T10:10:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:20572","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-26T10:07:33Z","modified":"2026-10-17T10:10:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20573","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-26T10:07:34Z","modified":"2026-10-17T10:10:43Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20577","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-26T10:07:36Z","modified":"2026-10-17T10:10:43Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20810","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-27T10:07:24Z","modified":"2026-10-17T10:10:50Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:24342","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-06-08T10:06:38Z","modified":"2026-10-17T10:11:19Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2026:13641","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-06T12:05:16.751656Z","modified":"2026-05-06T12:30:41.823274Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:13670","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-06T06:02:14.811706Z","modified":"2026-05-06T06:30:28.504283Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:19034","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T16:03:24.060458Z","modified":"2026-05-29T16:30:08.965816108Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:19189","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-21T16:27:07.11942Z","modified":"2026-05-21T17:00:07.071952908Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"ROOT-APP-PYPI-GHSA-78cv-mqj4-43f7","title":"GHSA-78cv-mqj4-43f7 in tornado - Patched by Root","description":"Root has patched GHSA-78cv-mqj4-43f7 in the tornado package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-12T08:34:51Z","modified":"2026-10-12T09:15:03.430860303Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2026-35536","description":"In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.","status":"published","published":"2026-04-03T04:16:00Z","modified":"2026-07-22T20:45:44.229642182Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ALSA-2026:13641","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-05T00:00:00Z","modified":"2026-10-29T11:58:14.029138Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:13670","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-05T00:00:00Z","modified":"2026-10-29T11:32:30.741908731Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19034","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:16.097018686Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19189","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:31.270652242Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"CLSA-2026-1776386115","title":"TuxCare security update for tornado (6 CVEs)","description":"TuxCare rebuilt tornado to address 6 CVEs. Fixed in 6.1.0.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:48:04.993235199Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1790675116","title":"TuxCare security update for tornado (15 CVEs)","description":"TuxCare rebuilt tornado to address 15 CVEs. Fixed in 5.1.1.post4+tuxcare.","status":"published","published":"2026-09-29T09:45:16Z","modified":"2026-10-15T09:48:02.299807474Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"MGASA-2026-0216","title":"Updated python-tornado packages fix security vulnerabilities","description":"Tornado has a DoS due to too many multipart parts. (CVE-2026-31958)\nIn Tornado, cookie attribute injection could occur because the domain,\npath, and samesite arguments to .RequestHandler.set_cookie were not\nchecked for crafted characters. (CVE-2026-35536)\n","status":"published","published":"2026-06-17T06:43:54Z","modified":"2026-06-17T06:45:04.038516108Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}